Offensive Security
Internal penetration testing: why we leave your EDR on
Switching off the EDR during a penetration test gives you a longer report, but a less accurate picture of your real exposure. Here is how we approach it.
When scoping an internal penetration test, one question comes up often: should the testers be allow-listed in the EDR, or should it be switched off on a few machines, "to save time"?
Our default answer is no. Here is why.
What we are actually measuring
An internal test starts from a simple assumption: an attacker already has a foothold on your network, with the rights of a standard user. That is the scenario of a successful phishing email, an infected workstation or a compromised supplier.
In real life, that attacker will not be allow-listed. If your EDR blocks a technique, that is useful information. If your SOC raises an alert twenty minutes later, that is even more useful. Disabling these controls means testing an environment that does not exist.
What you lose by switching them off
- Detection measurement. You no longer know whether privilege escalation or lateral movement would have been spotted.
- Prioritization. A vulnerability that can be exploited despite the EDR is more urgent than one the EDR already neutralizes.
- The conversation with your SOC. Alerts raised during the test are the raw material for a good debrief workshop.
How it changes the way we test
Keeping the EDR on forces us to work like a careful attacker: suitable tooling, quieter techniques, attack paths that go through configuration rather than detected tools. That is often where the most telling findings are: poorly controlled Kerberos delegations, overly permissive ADCS certificate templates, network shares holding secrets.
When the EDR really does stop us on a path, we document it as a positive finding. We can then agree with you on a controlled workaround to assess the rest of the chain. That decision is always made together, never silently.
What we agree on before starting
Everything is formalized in the authorization letter signed at scoping:
- Testing windows and escalation contacts.
- What the SOC should do if it detects activity: handle the alert as usual, or contact us before containing.
- Immediate stop criteria, for example an impact on production.
- How critical findings are handled: reported right away, without waiting for the final report.
In short
An internal penetration test is not meant to produce the longest possible list of findings. It should tell you what an attacker would actually reach today, and whether you would see them coming. Leaving your defenses in place is the most honest way to answer both questions.